Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Japan facing credit card number shortage

mainichi.jp

Post reply on HN
Print view View original

101–110 of 360 posts

Re: Japan facing credit card number shortage

#101

Post by devy »

joshfraser wrote: post #96

What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.

Talk about the power of inertia when attempting to change consumer behaviors.

Also, we still haven't had an easy to use open tool set to make usage of Public Key Cryptography friendly to average Joes. No, GnuPG doesn't count - it's hard to use and cumbersome to configure it securely. You need to be a cryptographer or a mathematician to pick the right parameters in order to stay current and secure. Definitely not friendly even to most programmers.

Re: Japan facing credit card number shortage

#102

Post by michannne »

joshfraser wrote: post #96

What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.

How would encryption improve the security of a physical credit card?

Re: Japan facing credit card number shortage

#103

Post by sgjohnson »

>In the case that the number of card digits will be increased, it is necessary to discuss within the industry whether the 16-digit cards that already exist should all be changed into new cards as well, or if the two types can exist alongside each other.

This is literally a non issue. Amex cards have 15 digits and a 4 digit CVV I've literally never had any issues with it.

Re: Japan facing credit card number shortage

#104

Post by jacobr1 »

michannne wrote: post #24
jandrese wrote: post #16

Earlier quoted context omitted.

The identifier is hidden from the user so if it's huge and complex that is no problem. My point is that we're talking about putting a lot of effort into overhauling the system to support a scheme that is arguably already obsolete. If we're putting in the effort we should just remove the old insecure digits entirely and focus on a cleaner modern solution.

The problem with that is the purpose of a credit card system is convenience, especially the convenience involved in being able to represent the identifier in an easily compact manner. When it's a few groups of digits, I can print it onto a card or piece of paper, and just plug the digits in whenever I need to validate the number and run a transaction. You can't do that with a token. What happens when I want to use my…

Some new cards are moving this model:

When possible some more complex key/token is passed, maybe via nfc, or some other mechanism.

When not possible, a 4x4 number is generated and challenge/response is required to confirm intent before approving the spend.

Re: Japan facing credit card number shortage

#105

Post by sgjohnson »

sydd wrote: post #92
gruez wrote: post #2

>the company decided to take makeshift measures such as reusing credit card numbers of discontinued cards after a certain period had passed since cardholders canceled their memberships. However, there are considerable risks of fraudulent usage What are the risks here, and why aren't they already present by someone generating credit card numbers with a RNG? AFAIK credit card transactions are authenticated by at least…

Credit card numbers can be easily generated, there are tons of generators online. The right solution is not to have a number that you give out to random people who then gain access to your money. Also the righ way is not to trust the few giant credit card corporations to move all the money in the world The right way (EU is introducing it) is that you get a payment request that you can paste into your bank app and the…

I can't stand it. Amex have implemented Express List to deal with this, and you can automatically add any new sites that you use your card in to the list. It doesn't even automatically trigger 2FA.

Re: Japan facing credit card number shortage

#106

Post by ReactiveJelly »

michannne wrote: post #102
joshfraser wrote: post #96

What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.

How would encryption improve the security of a physical credit card?

It only works if you have a chip inside, like Yubikey and other HSMs do.

You can't do crypto with dumb block storage.

But if you have a chip you should absolutely do _something_ smarter than storing and reciting the number verbatim.

Re: Japan facing credit card number shortage

#107

Post by michannne »

ReactiveJelly wrote: post #106
michannne wrote: post #102

Earlier quoted context omitted.

How would encryption improve the security of a physical credit card?

It only works if you have a chip inside, like Yubikey and other HSMs do. You can't do crypto with dumb block storage. But if you have a chip you should absolutely do _something_ smarter than storing and reciting the number verbatim.

At that point why even show the number? It would be useless without the encryption. And if you have some way to enter the numbers so online transactions still work, then what is the point of the encryption?

I don't believe the majority of fraud is stolen physical credit cards

Re: Japan facing credit card number shortage

#108

Post by AmericanChopper »

devy wrote: post #101
joshfraser wrote: post #96

What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.

Talk about the power of inertia when attempting to change consumer behaviors. Also, we still haven't had an easy to use open tool set to make usage of Public Key Cryptography friendly to average Joes. No, GnuPG doesn't count - it's hard to use and cumbersome to configure it securely. You need to be a cryptographer or a mathematician to pick the right parameters in order to stay current and secure. Definitely not frie…

The problem isn’t the tools. It’s that there is no such thing as an operable PKI. The best PKI (by far) is the CA system, and the CA system is not a good PKI. It has so many holes, and the PKI evangelists don’t like it anyway, because it uses trusted authorities. The only other examples of remotely useful PKIs in existence are things like Signal/WhatsApp... and those are even worse PKIs, because TOFU PKIs are in practice authenticationless PKIs.

Re: Japan facing credit card number shortage

#109

Post by fomine3 »

ReactiveJelly wrote: post #106
michannne wrote: post #102

Earlier quoted context omitted.

How would encryption improve the security of a physical credit card?

It only works if you have a chip inside, like Yubikey and other HSMs do. You can't do crypto with dumb block storage. But if you have a chip you should absolutely do _something_ smarter than storing and reciting the number verbatim.

IC is secure by anti-tampering so it's secure at least now.

Re: Japan facing credit card number shortage

#110

Post by bausano_michael »

mjlee wrote: post #9
jandrese wrote: post #6

Assuming the last digit is a checksum and the first six are taken by the routing information, that leaves them 9 digits or a billion possible numbers per credit card issuer. Japan has a population of about 125 million. Are Japanese people cycling their numbers so frequently? Or are they big on ephemeral card numbers? Is it not possible for an issuer to get a second prefix if they run out of digits? I also wonder if c…

https://en.wikipedia.org/wiki/Luhn_algorithm describes the way the check digit is calculated.

ISBN also uses last digit as a check digit:

https://en.m.wikipedia.org/wiki/International_Standard_Book_...

Post reply on HN